improvement(org): one section rule and an organization-owned error policy

Author: waleedlatif1

apps/sim/app/api/organizations/[id]/home/workspace-activity/route.ts

@@ -1,24 +1,29 @@
 import { getOrganizationHomeWorkspaceActivityContract } from '@/lib/api/contracts/organization-home'
 import {
+  createInternalResourceConcealmentPolicy,
   defineInternalJsonRoute,
+  internalErrorResponse,
+  internalOrchestrationErrorPolicy,
   internalRateLimits,
   internalSessionAuth,
 } from '@/lib/api/server/routes'
 import {
   organizationHomeWorkspaceOperations,
   readOrganizationHomeWorkspaceActivity,
 } from '@/lib/organizations/application/home-workspaces'
-import { createCredentialGroupInternalErrorPolicy } from '@/app/api/workspaces/[id]/credential-groups/error-policy'
 
 export const GET = defineInternalJsonRoute({
   contract: getOrganizationHomeWorkspaceActivityContract,
   auth: internalSessionAuth,
   operation: organizationHomeWorkspaceOperations.readActivity,
   rateLimit: internalRateLimits.user({ bucketName: 'organization-home-workspace-activity' }),
-  errorPolicy: createCredentialGroupInternalErrorPolicy(
-    'Failed to load workspace activity',
-    'Organization not found'
-  ),
+  errorPolicy: createInternalResourceConcealmentPolicy({
+    base: {
+      project: internalOrchestrationErrorPolicy.project,
+      unhandled: () => internalErrorResponse(500, { error: 'Failed to load workspace activity' }),
+    },
+    notFoundMessage: 'Organization not found',
+  }),
   mapInput: ({ params }) => ({ organizationId: params.id }),
   useCase: readOrganizationHomeWorkspaceActivity,
   staticResponseHeaders: { 'Cache-Control': 'private, no-store' },

apps/sim/lib/organizations/home/workspace-activity.ts

@@ -53,8 +53,8 @@ export function readRunningWorkflows(
 
 /**
  * Per workspace, one workflow waiting on a person and the newest retained run. Each is a `LIMIT 1`
- * probe, so a workspace with thousands of unanswered pauses costs what one does. The waiting workflow
- * is therefore any of them rather than the newest, since finding the newest would read them all.
+ * probe, so many unanswered pauses cost what one does once a match exists. The waiting workflow is
+ * therefore any of them rather than the newest. With no match, the probe reads every live pause.
  */
 export function readReviewAndLastRun(workspaceIds: readonly string[]) {
   const logs = workflowExecutionLogs

apps/sim/lib/organizations/settings-sections.ts

@@ -2,17 +2,16 @@ import {
   ACCOUNT_SETTINGS_ITEMS,
   type AccountSettingsSection,
   getSettingsSectionMeta,
-  isOrganizationSettingsSectionAvailable,
   ORGANIZATION_SETTINGS_GROUPS,
   ORGANIZATION_SETTINGS_ITEMS,
   type OrganizationSettingsFeatures,
   type OrganizationSettingsSection,
   parseSettingsPathSection,
-  resolveOrganizationSectionAccess,
   type SettingsNavigationItem,
   toSettingsHeaderMeta,
 } from '@/components/settings/navigation'
 import type { SettingsHeaderMeta } from '@/components/settings/settings-header'
+import { organizationSupportsSettingsSection } from '@/lib/settings/section-availability'
 
 /**
  * A section on the organization surface's settings, tagged with the plane that
@@ -84,18 +83,8 @@ export function organizationSettingsNavigation(
   features: OrganizationSettingsFeatures,
   availability: { connectedAccounts: boolean; search: boolean; knowledgeGraphs?: boolean }
 ) {
-  return ORGANIZATION_SETTINGS_ITEMS.filter(
-    (item) =>
-      (item.id !== 'knowledge-graphs' || availability.knowledgeGraphs === true) &&
-      (item.id !== 'connected-accounts' || availability.connectedAccounts) &&
-      ((item.id !== 'search-mcp' && item.id !== 'search-slack' && item.id !== 'integrations') ||
-        availability.search) &&
-      resolveOrganizationSectionAccess({
-        section: item.id,
-        isTargetOrganizationMember: true,
-        isTargetOrganizationAdmin: isAdmin,
-      }) !== 'unavailable' &&
-      isOrganizationSettingsSectionAvailable(item.id, features)
+  return ORGANIZATION_SETTINGS_ITEMS.filter((item) =>
+    organizationSupportsSettingsSection(item.id, features, availability, isAdmin)
   )
 }
 

apps/sim/platform/checks/live/zone.spec.ts

@@ -33,6 +33,18 @@ for (const [from, to] of REDIRECTS) {
   })
 }
 
+test('the component workbench is not served by a live zone', async ({ page }) => {
+  const response = await page.goto('/org/workbench?recipe=C1084')
+  expect(response?.status()).toBe(404)
+})
+
+test('a Slack handoff link stays on the legacy integrations page', async ({ page }) => {
+  await signInAsAdmin(page, '/org/home')
+  const target = legacy('/integrations?slack=not-a-token')
+  await page.goto(target)
+  await expect(page).not.toHaveURL(/\/org\//)
+})
+
 test('a route with no Platform counterpart stays legacy', async ({ page }) => {
   await signInAsAdmin(page, legacy(UNMAPPED))
   await expect(page).toHaveURL(new RegExp(`${escapeRegExp(legacy(UNMAPPED))}$`))